---
schema_version: "1"
id: dc9b78d6aaf92d3e5ae60526d85abb24b79ea0c2450cadb5dd481d690c765045
title: GetJWTByKeyName()
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/marketing-cloud/ampscript/references/encryption/mc-ampscript-reference-encryption-get-jwt-by-key-name.md
canonical_url: https://developer.salesforce.com/docs/marketing/marketing-cloud-ampscript/references/mc-ampscript-encryption/mc-ampscript-reference-encryption-get-jwt-by-key-name.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 8246b3396d822e5d07a4c9de316854cd5d8e70f45ff2f3d417ad819b17c82585
products:
  - AMPscript for Marketing Cloud
  - Marketing Cloud
---
# GetJWTByKeyName()

Creates a JSON Web Token (JWT) for a JSON payload. This function uses a key that’s stored using a key stored in [Key Management](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_key_management.htm).

JWTs offer a method of securely transmitting information between parties as a JSON object. The information is digitally signed using cryptographic algorithms. Because the JWT is signed, parties that receive a JWT can be assured that the data wasn’t tampered with in transit. Marketing Cloud Engagement supports hash-based message authentication code (HMAC) and Rivest–Shamir–Adleman public-key signatures (RSA signatures).

**important:** We recommend that you use `GetJWTByKeyName()` instead of its companion function [GetJWT()](https://developer.salesforce.com/docs/marketing/marketing-cloud-ampscript/references/mc-ampscript-encryption/mc-ampscript-reference-encryption-get-jwt-by-key-name.md). The difference between `GetJWTByKeyName()` and `GetJWT()` is the first parameter. In the `GetJWT()` function, you pass your secret as the first parameter in plain text. With `GetJWTByKeyName()`, you pass a reference to a key that’s stored using the [Key Management](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_key_management.htm) feature of Marketing Cloud Engagement. With Key Management, you can also control which users have access to your keys. These factors make the `GetJWTByKeyName()` function more secure for most use cases.

## Availability

<table>
  <tr>
    <td>Marketing Cloud Engagement</td>
    <td>✅ Yes</td>
  </tr>
  <tr>
    <td>Marketing Cloud Next</td>
    <td>❌ No</td>
  </tr>
</table>

## Syntax

The `GetJWTByKeyName()` function uses this syntax: `GetJWTByKeyName({keyName}, {algorithm}, {jsonPayload})`

The function has the parameters listed in this table.

| Name          | Type   | Description                                                                                                                                                                                                                                                                                                                                                                                                                |
| ------------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `keyName`     | String | Required. The external key of a key that’s stored using Key Management. The function converts the key string to a byte array using UTF-8. It supports Base 16, Base 64, and ASCII character strings.                                                                                                                                                                                                                       |
| `algorithm`   | String | Required. A string that indicates which cryptographic algorithm and hash function to use in the token. Possible values:<ul><li>`HS256`—HMAC secret with SHA-256 hash</li><li>`HS384`—HMAC secret with SHA-384 hash</li><li>`HS512`—HMAC secret with SHA-512 hash</li><li>`RS256`—RSA signature with SHA-256 hash</li><li>`RS384`—RSA signature with SHA-384 hash</li><li>`RS512`—RSA signature with SHA-512 hash</li></ul> |
| `jsonPayload` | String | Required. The payload of the JWT. Typically, the payload is a JSON object with name-value pairs. The JWT payload isn’t encrypted.                                                                                                                                                                                                                                                                                          |

## Usage

To use the function, specify the external key of the key to use to sign the token. Next, specify the encoding algorithm. Lastly, provide the payload that you want to encode.

```
%%[
  Var @JWT
  Var @JSON
  Var @HREF

  Set @JSON = '{
    "first_name": "Tomás",
    "last_name": "Santos",
    "email": "tomas.santos@example.com",
    "campaign_id": "928348"
  }'
  Set @JWT = GetJWTByKeyName("JwtKey2", "HS256", @JSON)
  Set @HREF = Concat("https:///www.example.com?sign=", @JWT)
]%%

<p>%%=V(@HREF)=%%</p>
```

The function outputs a JWT.

<!-- This JWT contains fictitious data and doesn't present a security risk. -->

```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmaXJzdF9uYW1lIjoiVG9tw6FzIiwibGFzdF9uYW1
lIjoiU2FudG9zIiwiZW1haWwiOiJ0b21hcy5zYW50b3NAZXhhbXBsZS5jb20iLCJjYW1wYWlnbl9pZCI
6IjkyODM4NCJ9.EDh9eRIiFCndRAFcup4R2VktJJXA90Ms4M3rRL5FfZk
```

If the syntax for the function is invalid, the function returns an `InvalidFunctionException` error. This error can occur if you call the function without providing the right number of parameters or if you provide an invalid data type for a parameter.

If the function call contains invalid data, it returns a `FunctionExecutionException` error. This error can occur if one of the parameter values is invalid. For example, the error is returned when the syntax of the JSON payload is incorrect.